My son had his Zelle hacked and apparently it's easy to do. See here: https://bobsullivan.net/cybercrime/heres-how-hackers-are-using-zelle-to-raid-bank-accounts-and-why-victim-was-out-1800-until-i-wrote-to-the-bank/ and other articles about Zelle hacking on that site.
The thing not mentioned in the article is that once the hacker has added a phone number and raided your bank account, they delete the number and Zelle keeps no record of it, so there's no way to even try to track down the thief via phone number.  This my have changed since it happened to our son, I don't know, and yes this can be minimized if only people would use more secure passwords and keep a closer eye on their account activity, but there it is.